use std::fs;
use tonic::transport::{Certificate, ClientTlsConfig, Identity};
use anyhow::Result;

pub fn load_client_tls_config() -> Result<ClientTlsConfig> {
    // 安装默认的加密提供程序
    rustls::crypto::aws_lc_rs::default_provider()
        .install_default()
        .map_err(|_| anyhow::anyhow!("Failed to install crypto provider"))?;
    
    let ca_cert = fs::read("certs/ca-cert.pem")?;
    let client_cert = fs::read("certs/client-cert.pem")?;
    let client_key = fs::read("certs/client-key.pem")?;
    
    let ca_certificate = Certificate::from_pem(ca_cert);
    let identity = Identity::from_pem(client_cert, client_key);
    
    let tls_config = ClientTlsConfig::new()
        .ca_certificate(ca_certificate)
        .identity(identity)
        .domain_name("1.14.199.50");
    
    Ok(tls_config)
}